Latest / Identity at the Center / #311 - Navigating Identity Management and Cyber Insurance with Brandon Pinzon

Transcript

#311 - Navigating Identity Management and Cyber Insurance with Brandon Pinzon · Identity at the Center

0:00
It's just getting down to the basics, being aware of the risks
0:05
that you carry and then focus on one of the three things.
0:09
Managing your assets, managing change to those assets and
0:13
certainly managing identity. That's your Holy Trinity when it
0:16
comes to the basics of what a security program is is intending
0:21
to have oversight, monitor and protect.
0:29
This is identity at the center. If it has anything to do with I
0:35
Am, this is the go to podcast now your host Jim McDonald and
0:42
Jeff Steadman. Welcome to the Identity at the
0:51
Center podcast. I'm Jim McDonald.
0:53
I'm not joined by my Co host Jeff Sedman.
0:56
Today. He's still suffering the
0:58
aftermath of Hurricane Helene. He's basically at the point
1:02
where he's got electricity and nothing else, including running
1:05
water. So we wish the best for Jeff.
1:08
What's fantastic is that he's been editing the podcast in the
1:12
background. So we'll have this episode
1:14
coming out this Monday as we've always done.
1:18
You know what they say in in the business.
1:20
The show must go on today. I've got a couple of discount
1:27
codes that I want to go over, and then I'm going to introduce
1:29
our guests. So it's the same discount codes
1:31
we've been talking about on the recent episodes.
1:34
But first let me talk about Sempress's Hybrid Identity
1:38
Protection Conference, or it's also known as the Hip Conf.
1:42
It runs from November 13th through 14th.
1:45
The best part is it's in New Orleans, which is a really fun
1:49
city if you haven't been there, but it's going to be a great
1:52
learning event. You can use the POT, the code,
1:56
IDAC pod, IDAC pod and that'll get you 20% off.
2:01
Then of course, one of the biggest events in the identity
2:04
calendar is the Gardner IM Summit that's going to be in
2:08
Grapevine, TX in December. It we have a discount code that
2:12
saves you $375 on registration. Our exclusive code is IDAC 375.
2:20
You're not going to find a better discount code than that
2:23
so I highly encourage you to go out there, register for that
2:26
conference and use that discount code So today I'd like to
2:31
introduce a very special guest. This is somebody that I've
2:34
worked with in the past and he's a friend as well as a a great
2:41
mind in our industry. His name is Brandon Pinzon, he's
2:45
an insurance industry cybersecurity executive.
2:49
Brandon, welcome to the show. Thanks for having me Jim, and
2:53
all the best to Jeff as well. I know our thoughts, prayers and
2:56
good vibes go that way for sure all those that are affected.
3:00
Thank you. Thank you very much, Brandon.
3:03
It's it's tradition here at the Identity of the Center podcast
3:06
to ask our guest their identity origin stories.
3:10
So how did you get into digital identity?
3:13
Did it choose you or did you choose it?
3:17
I think I've had the good pleasure over my career of
3:19
actually having it happen both ways.
3:21
So in my last role for an employer, I chose it.
3:25
After going through and really experiencing, you know, the
3:29
opportunities to kind of introduce some monitoring
3:33
elements to identity architecture and engineering.
3:36
I think that's where our paths crossed.
3:38
That was in financial services. Prior to that, I was in the
3:41
hosting space. And so I had the opportunity to
3:44
really establish the governance, really look at the
3:47
transformations both on how we enter into our customers
3:51
environments to do the things that they asked us to do as well
3:55
as protecting the estate. And so I was very close to that,
3:57
especially in running and helping with the security
4:01
program. But my origin story really
4:03
happened in banking. You know, I ended up owning the
4:06
show when it came to identity and that was the architecture,
4:10
engineering and provisioning back when you had security and
4:14
IT probably a little bit more closer together, You know, how
4:17
we had the opportunity to kind of start to break it out.
4:20
Really, this is kind of where I think it chose me was when we
4:25
were able to go and separate ourselves and then out of
4:28
necessity, you know, the financial crisis that was taking
4:32
place of subprime lending markets, financial scrutiny
4:35
going up, Sarbanes-Oxley going up, going back and introducing
4:38
that monitoring element, right? That's kind of where it started
4:41
for me. And so, you know, from applying
4:45
policy to automating to sending out the little tangible tokens
4:49
to rebadging everybody, you know, the Axis governance St.
4:53
suites all the way through the automation of, you know, recent
4:57
and looking for fraud, looking for account takeover, looking
5:00
for how do you streamline, you know, a deal with password list
5:03
types of strategies. Like I've been around for all of
5:06
this, which has been a lot of fun.
5:08
Yeah, it's a lot of fun, gives you a lot of insight and you
5:12
know, nothing happens without access, identity and access.
5:15
It's kind of the the center of identity, if you will, or a
5:20
center of security, I think. So one of the things that you
5:26
and I had touched based on and it got me to say, Brandon, I
5:29
need to get you on this podcast is we're going back and forth
5:32
and talking about where in an organization does identity
5:37
management belong? You know, does it belong in
5:40
information security or somewhere else?
5:42
So I'd like to get. Your take on that?
5:45
Yeah, it's one of the wonderful debates and it's one of the
5:49
things that, you know, talking to my my peers in industry, my
5:53
peers Cesos, it's, it's been fascinating to not only share
5:57
the perspective, but also kind of also share, you know, my
6:00
personal perspective as well. So I would say, look, when you
6:03
think about the origins of identity and the purpose, it was
6:06
really to be measured against delivering service to get folks
6:10
into the workforce, to get the right provisioning, to get the
6:14
right access to the systems and the data that they need to do
6:17
their job. And that was the metric.
6:19
It was really that user experience in getting it in
6:21
there. And so by that nature, it's been
6:24
owned historically in IT. And I think in the last two
6:28
years, 18 months, as we've kind of seen this kind of focus even
6:33
more pronounced in my opinion on that monitoring element.
6:37
You know, we've seen the other breaches going up, we've seen
6:39
root causes, We've heard kind of the tag lines of, you know, the
6:44
adversaries don't just break in, they login types of things.
6:48
It's really introduced the opportunity for the security
6:51
organization to then take on the architecture and the engineering
6:56
and help pay back some of the debt that I think has occurred
6:58
over the course of, you know, the, the journey of, of
7:01
identity. I think that as an industry,
7:04
we've kind of seen this, I'm gonna sort it out later, sort it
7:07
out later. And I think later it showed up.
7:09
And so I think that the architecture and the
7:13
engineering, it's more of a shared fee, right?
7:17
It's a shared combination, no different than, say, managing
7:20
vulnerabilities or managing source code or managing
7:23
endpoints. There's an element to provide
7:25
the process at which I believe lives in ITI believe to apply
7:31
the right monitoring elements and controls that lives in the
7:35
security organization and the ability to have that oversight,
7:39
commoditize the controls, look and build that predominantly
7:43
lives in the security organization.
7:45
And so that's a seeso and where we also see the landscape
7:49
shifting. So there's ample opportunity to
7:52
look for that. It provides a better user
7:54
experience. It provides the ability to stay
7:56
focused on a lot of these transformational projects.
7:59
And I think we're going to start to see more of a shift in that
8:02
direction. Yeah, I, you know, I think what
8:05
I see a lot in my day job as a identity consultant is that
8:12
workforce identity is probably more often than not in the Cecil
8:18
organization or at least in I, you know in technology.
8:24
Whereas I see customer, I am in more of a marketing type
8:29
responsibility. It's like it's a fast added on
8:32
and maybe the Sea Show has a seat at the table, but it's more
8:37
marketing driven. What do you think of that and do
8:40
you see that as well? I think that if we treat the two
8:45
programs with different strategies and approach it,
8:49
you're, you're definitely aligning for the business with
8:52
the business. But but the customer identity
8:55
problem presents the biggest opportunity to really help
8:58
understand and drive a better user experience.
9:00
In fact, I don't think there's any better representation than
9:03
to give a a prospective or existing customer a better way
9:08
to enter into your environment with the right monitoring and
9:12
controls in place and do so at the onset with the engineering.
9:16
And so you know, I've seen them treated separately.
9:19
I've seen customer identity, for example, live in say more of a
9:24
digital team, for example. However, when things go bump in
9:28
the night or if things aren't properly monitored, well, then
9:33
the security organization is brought in to kind of look at it
9:35
a little bit more kind of reactively.
9:38
And then depending on how many incidents originate or you're,
9:42
if fraud or account takeover falls under your remit, well
9:46
then you're kind of at a disadvantage because you're kind
9:48
of having to understand again, where data is coming in kind of
9:52
the, the whole lineage. And so you kind of have some
9:55
certainly have some exposure there.
9:57
And then also it's not uncommon for those types of environments
10:02
to be kind of commingled with the IT organization jobs,
10:07
batches, bots effectively running to do jobs, but then
10:10
marrying that along with looking for anomalous behavior, which is
10:13
a lot of what the security function is looking at.
10:15
And so things like rate limiting, looking at, you know,
10:18
brick forest, how do you, you know, properly tombstone or
10:23
isolate a account? And then also how do you
10:27
reconcile because the same processes apply.
10:30
You may have accounts and you may be sharing data with
10:34
customers or third parties in one form or another.
10:37
How do you know that that's the right individual and they're not
10:40
sharing credentials if that's how you're using it or that
10:43
you're not revisiting them, especially as that relationship
10:47
grows over the course of time or may become stagnant?
10:50
So I think that, you know, while it does differ, there's a lot of
10:54
complementary process and technology that really helps
10:58
automate and helps bring that 360 together because that's what
11:02
we're really after. Yeah, Brenda and I, I think that
11:08
there's a lot to unpack there. It kind of feels like having a
11:15
strong identity practitioner background kind of sets a person
11:20
up really nicely for that cease of role, especially when the
11:26
identity component becomes part of the responsibility.
11:29
Because I kind of feel like folks who are steeped in
11:32
identity get identity and people outside of identity don't always
11:37
What What do you think of that? I I think it absolutely rounds
11:41
it out because in the in the end, what you're looking to do,
11:45
whether it's a system or it's somebody that's an end point
11:52
user or somebody that's a customer or third party.
11:55
You're you're trying to figure out that who, even if it's a non
11:59
interactive or a non human type of an account, right?
12:02
You're still trying to find that lineage and that traceability
12:05
to, again, for put incidents aside, really get a process to
12:12
understand the context of what your environment is.
12:15
If you don't have that, you're blind.
12:17
And I think when it gets down to you in history, look at any of
12:21
the reports that are out there that start to trace and trend,
12:26
You know, the root causes of breaches, incidents, reportable
12:29
events at some point or another, that the conversation with
12:34
credentials is pronounced right. There is a root cause that's
12:38
there. It's still an attack vector.
12:40
Credential stuffing is still a thing.
12:43
Phishing and looking for accounts is still absolutely a
12:48
thing. And it's, it's, it's I think the
12:51
gift that keeps on giving if you don't have the right things in
12:54
place. Yeah, it feels like the the
12:57
route to understand an attack from a forensic standpoint in
13:02
the past was based on OK, can we show that this IP traversed or,
13:09
you know, these signatures from the device had this, had this,
13:14
you know, path through the systems.
13:17
But really it's the identity often times could be changing IP
13:22
addresses, could be changing devices.
13:25
So it feels like the industry's starting to recognize that you
13:29
see that with the, the ITDR space kind of taking off.
13:34
And I feel like that's one of the, the pros for why a CSO
13:40
should be or why identity should roll up to the CSO.
13:45
I, I think a con, at least in my mind, is that the CSO is
13:49
responsible for setting policies for applications and systems.
13:55
And now you're saying CSO, you're responsible for an
13:58
application And that CSO may be facing deadlines that he or she
14:03
has communicated to their boss, to other executives, to the
14:08
board, and now may be facing a deadline.
14:12
I'm either going to make my my date or I'm going to have to
14:17
roll it back because I didn't get all the boxes checked that I
14:22
need to get checked per my own process.
14:25
So it's almost like a conflict of interest.
14:27
What do you think of that and what are some other pros and
14:30
cons for, you know, whether or not or having a Cecil
14:34
responsible for identity? You know, I think of certainly
14:39
the conflict is well described and and that's well stated, but
14:43
I think about, you know, when you set policy, right, you're
14:46
setting it based on kind of a, a even handshake, right?
14:50
Just because you're AC so and you hold a title doesn't mean
14:54
that you're getting there through asserting an authority,
14:58
right? You're not dominating an IT
15:00
organization through policy. You're working together to
15:04
engineer that shared fate. And I think when you know, when
15:09
you think about what are you preventing or what are you
15:11
trying to pay against or, or pay down the risk you're trying to
15:16
pay down, it's really a, a total takeover of the source of truth
15:23
for your identity. I, if a threat actor take gets
15:26
access to, you know, the core of your Active Directory or the
15:29
core of your identity or the core of those types of services
15:32
and they're able to go through and, and move pretty much
15:36
unfettered, Well, that makes a bad day completely worse.
15:40
Your clean up job gets exponentially worse.
15:44
And so I think the cons come in the form of really the
15:47
provisioning aspect, right? Going through and expecting
15:51
that, you know, while you do have context in the, the CSO
15:55
organization that there's not going to be friction or that
15:57
you're going to be held to an SLA and you end up kind of
16:01
throwing things over the fence. I think that's certainly a, a
16:05
possible con if you don't enter into the strategy and the
16:10
transformation in line and lock step with the IT organizations
16:14
because somebody has to go through a provision according to
16:17
an SLA just like you have to receive your equipment just
16:20
like, well, you have to go and receive and make sure that the
16:22
right reviews happen over the period of time.
16:25
And we do that through automation, right?
16:28
At the same time, we want the, the, the identity engineers that
16:35
are on the security organization to sit alongside to understand
16:38
how the roles are being built 'cause if you take something
16:41
like your HR management system, you take something like an
16:45
Oracle financials or something that's a SAS or something
16:48
that's, you know, running your back end infrastructure.
16:51
Those have different roles. And what you're trying to do is
16:54
build the right entitlement so that especially those privileged
16:56
roles, you know, have the right ability to go and do what they
17:00
need to do or experience and have access to that data again.
17:04
So a con is when I think there is an over indexing or lack of
17:07
understanding of what usability and service level looks like
17:12
with really the stack, the responsibility of implementing
17:16
the monitoring. So if you're both, you know,
17:19
the, the throwing the ball and judging and saying if there's a
17:24
ball or a strike, there's a problem there.
17:26
And I think that's where you do need that independence, you need
17:30
that objectivity. But you do have to have a shared
17:32
faith and shared outcome. Yeah, I think that's that's
17:36
really interesting how you put all that.
17:39
Now I have a even a fundamental question about what it means to
17:45
own identity, because it seems to me, you know, some
17:49
organizations, their identity team has some developers and
17:53
some engineers and they're part of the information security
18:00
team. Other organizations don't want
18:02
to put their developers in information security.
18:06
They want to keep them in other areas of the business.
18:09
Does does owning identity have anything to do with where the
18:13
resources report? I think that there's two aspects
18:17
to resource, right? There's where the human capital
18:20
sits, and then there's where the budget sits.
18:22
And they're not mutually exclusive.
18:24
I recognize that. And so part of what a successful
18:28
security program looks like is that you're the good steward,
18:31
you're the good business partner.
18:34
And not all organizations are gonna have or even you know, IT
18:38
organizations departments onto the IT organizations are gonna
18:42
be well staffed or well resourced.
18:44
And so if you're given the opportunity to provide some
18:47
automation or to provide subject matter expertise for to sit
18:50
alongside with the teams that pose the highest risk, whether
18:55
you know they're defending or supporting or managing the crown
18:59
jewels, depending on how your methodology determines that,
19:03
it's important to understand that you know, it is a team
19:05
effort on that piece. And so again, it's not really
19:09
related to asserting dominance or asserting a level of power
19:15
over somebody. It's about sitting alongside
19:17
with them. So what typically happens is you
19:20
take a look at some sort of a transformation, that new thing
19:24
for example, that is going to get built, which may serve as a
19:27
Greenfield for some organizations to then do it
19:30
correctly. But you also have to manage the
19:33
entire life cycle. You have to go through and
19:35
really see it through these transformations, these identity
19:39
strategies are multi year. You know, in many cases you're
19:43
doing pretty well. If you're looking at three years
19:45
to start, you know, to depending on how much you're taking on and
19:48
what you're deploying and what you're rolling out, you're
19:51
looking at a three-year transformation from, you know,
19:53
kind of the inception to when you start getting things rolled
19:56
out. And then again, where it really
19:59
gets challenging is in that provisioning.
20:02
And then at some point somebody has to reconcile who has access
20:06
to that. Data or someone has to reconcile
20:09
who has access to that system. So removing that friction and
20:12
that may sit outside of the even the IT organization is an
20:16
opportunity to score some major points.
20:19
Especially when you're helping not even talk about identity,
20:22
but talk about a better on boarding experience, less
20:26
tickets, less reliance on someone you know to increase
20:32
cost to go and build something that is not part of you know the
20:36
overall process flow. Or have a better customer
20:40
experience on seeing that new cool thing that coincidentally
20:44
satisfies a regulatory or compliance requirement.
20:48
That's a great overview, man. And I think that you brought up
20:52
so many key points. Folks can go back and listen to
20:55
this, that section again. They're trying to, you know,
20:58
make the case to pull identity into information security or you
21:04
know, or straight up ask the question, where does I identity
21:08
belong in the organization? But I wanted to shift the
21:11
conversation Now, Brandon, a couple things I want to go over
21:15
while I have you here. And the first thing is around
21:19
getting the insurance industry perspective on identity.
21:23
In other words, how's it different?
21:25
So I think of insurance as financial services, but I also
21:31
think of banking as financial services.
21:33
But I feel like they're two different industry, banking and
21:38
insurance. And I'm wondering if you agree
21:41
with that and then kind of how the insurance industry is
21:44
different when it comes to identity?
21:48
Yeah. And I think the best way to
21:50
think about or separate financial services or, or kind
21:55
of maybe what they share financial services, the essence
21:57
of it is to calculate interest in some form or another.
22:01
And in the banking, you know, depending on the nature of your
22:03
banking, you're getting there through lending, you're getting
22:06
there through, you know, savings, deposits, checkings
22:09
types of things. And so, you know, with
22:12
insurance, it's a little bit different because what you're
22:16
effectively doing is you're, you're selling a promise.
22:19
It's not necessarily tangible. You're selling a contract and a
22:22
promise based on the policy that if those conditions are met
22:28
right and you suffer a loss, you will be compensated based on the
22:32
risk that we've agreed to and effectively what you know, what
22:37
the circumstances of your your loss is when you've adjudicated
22:40
it. And so when we think about it,
22:42
they both fall into the same levels of regulated industry,
22:46
but slightly different, but they still say share the same
22:49
problems certainly, which is kind of ubiquitous with other
22:52
areas as well. So you may have online portals
22:55
that are customer facing. That's how you get information
22:58
to and from your customers. However, you know, when you
23:02
think about from the insurance space, depending on where you
23:05
sit in the food chain, you know, you may be managing broker
23:08
relationships. In other words, you don't have
23:10
on staff sales force. You're relying on third parties
23:15
to go and interact and basically generate the gross written
23:18
premium or to get information to you so that you can make a
23:22
decision on whether or not you're gonna, you know, insure
23:25
that particular product. And then it kind of goes down
23:27
the line from there. At the same time, you know, that
23:31
term is finite, right? Let's just say you have a year
23:35
long policy and you experience no claim, no loss.
23:40
Well, great. There's no interaction with the
23:42
claims team. You don't necessarily have that
23:45
on the banking side, right, On the on the banking side, to draw
23:49
a parallel. So when you experience a loss,
23:51
you're working with your claims teams.
23:53
Well, then you have a whole flurry of information, right,
23:56
You have to go through and you know, depending on the nature of
23:59
what it is you're presenting, you know, medical bills, you're
24:02
presenting reconstruction costs, you're presenting all sorts of
24:06
things depending on the the nature of what you're insuring.
24:09
And I'm talking about specialty insurance, you know, personal
24:12
lines may be a little bit, you know, certainly adjacent, but
24:15
but kind of nuance to it. And so on the banking side, for
24:19
example, you know, you may be getting information to make a
24:22
loan, right. And so there's, so there's some
24:24
commonality there in terms of the kind of systems and where it
24:27
flows. I think the difference when you
24:29
look at all of the data and the way that you monetize data on
24:32
the insurance side, there's a tremendous amount of analytical
24:36
value that's there. And so that the traceability and
24:40
the provenance of that data, even if you say no to a deal,
24:43
the fact that you said no to the deal and the data that's
24:46
contained has analytical value, it goes to the actuary.
24:50
So they're going to use that in their models in one form or the
24:53
other. And then if you experience a
24:55
loss, you know all of the data that complements it also has a
24:59
tremendous amount of of analytical value because you're
25:02
trying to determine what went wrong to then help ideally
25:06
inform your customers or your policy holders or your future
25:10
policy holders on things you can do to prevent that boom or that
25:14
loss from occurring. So there's a little bit of a
25:16
nuance there, and I didn't appreciate that until I actually
25:19
got into the industry. There's a tremendous amount of
25:22
data, and then the Providence and understanding the data or
25:25
who you invite and how you interact with the data allows
25:28
for so many ways to really, you know, stretch your legs when it
25:31
comes to practicing identity, certainly in the security space
25:35
too. Yeah.
25:37
So you just open my mind to a whole question around that
25:42
analytical data. Does that lend itself at all to
25:47
making good identity decisions or is that completely separate?
25:52
That's just, that's the jewel you're trying to protect?
25:55
Or is there any way to tap into that data to maybe authenticate
26:00
a person properly or to, you know, do other life cycle events
26:05
like making sure that the person is, you know, still with us here
26:09
on this earth? Absolutely.
26:12
So I think talking about workforce or enterprise
26:15
identity, when you, when you start to experience data quality
26:19
issues, it's because you really have not or you've lost control
26:24
to the axis of where you're aggregating all of the data.
26:27
And so, you know, part of my experience over the course of
26:30
time has certainly been privacy related as a former data
26:33
protection officer, and I've been along with the privacy riot
26:36
for, you know, quite a long time.
26:39
But that when you think about not just using personal data,
26:43
but protecting all data and the data that you want to have
26:46
analytical value, you want to control access to that, There's
26:49
an integrity aspect to it. And so how do you do that?
26:52
Well, you want to make sure that you know, the, the, the
26:57
interactive and non interactive accounts that are interfacing
27:00
with that data are absolutely, you know, inspected or
27:04
monitored, are controlled, are dormant if they don't need to
27:08
be, you know, live and and active.
27:12
And so, you know, there's strategies to go through and
27:14
think about that. So from the workforce or
27:17
enterprise identity side, it's, you know, a, a wonderful feel on
27:21
the customer identity side or, you know, interacting with say a
27:24
claimant, for example, well, you know, there is insurance fraud,
27:29
right? And it invites the opportunity,
27:31
you know, to go through and really authenticate who you're
27:34
working with and to streamline that, right?
27:37
Because you know, the purpose of this is to deliver a good user
27:41
experience, right? And most times, you know, just
27:44
think about if you've ever had to file a claim, you're not at a
27:48
high point in your day, your, you know, situation.
27:52
And so you want to streamline that and you want to
27:54
authenticate and you want to also look for anomalous behavior
27:57
and claims fraud is, you know, a thing.
28:00
And it's certainly something that we're measured on, you
28:02
know, when it comes and it presents an ample opportunity
28:05
and a really good business case, you know, for customer identity
28:09
and re architecting or engineering and providing a
28:12
streamlined process to say, OK, I trust you.
28:15
I've established trust, let's get the information and
28:19
ultimately the intent is money will exchange hands based on the
28:23
nature of the contract or the policy that you you have
28:26
purchased. Yeah.
28:28
You brought up one another thing that it just triggered a a, a
28:32
level of interest which was thinking of that scenario where
28:37
you maybe have a customer who did business with your
28:41
organization or does business actively.
28:43
In other words, they're paying their premium every month for
28:46
the past, you know, 12 years and they haven't logged into their
28:52
logged into your application in that entire time. 12 years ago,
28:56
your password policy might have been needs to have 6 characters
29:00
and at least one number and at least one letter and you may
29:04
have moved on from not only that policy, but that entire
29:08
technology stack. So what kind of challenges does
29:13
that does that bring to an organization when you've run
29:16
into a scenario like that? Certainly, I mean, what, what
29:20
that provides is a higher risk profile, a higher and an
29:26
opportunity to really, really threat model and kind of look at
29:29
the risks that you're carrying. Because you know, insurance has
29:33
been around for a very, very long time, right?
29:36
And those systems and some of those core systems have been
29:40
around it, you know, for a long time as well.
29:44
And they may predate some of the modern advancements in managing
29:49
identities or managing the whole life cycle.
29:52
And that's not uncommon, especially in financial
29:55
institutions that have been around for 100 years, you know,
29:58
and they, they are potentially come to you.
30:01
I'm going to, I'm going to pay it back later, right?
30:03
I'm going to sort it out later. And so, you know, the challenges
30:07
are, you know, how do you go through and help effectively
30:12
retrofit or tag that or make that a candidate to then lower
30:17
your risk, right? Is that a candidate to go
30:19
through and, you know, effectively re platform and take
30:22
that opportunity? Or are you gonna introduce, you
30:25
know, compensating processes, which are effectively and
30:28
unfortunately very painful to do because those serve, as, you
30:33
know, the things that are easy, you can throw in automation.
30:35
Then there's kind of like this middle ground of things that I
30:39
don't quite know, but I'm going to sort out.
30:41
But that's typically what happens at the end of your
30:44
transformation because that's the real hard stuff, right?
30:47
And their technologies are there.
30:49
They're certainly processes and really just kind of going and
30:53
just kind of gridding it out to kind of understand what your
30:56
baseline is for good and then you introduce the automation and
31:00
the opportunity to automate and you know, address that last
31:04
percentile normally of kind of where that sits.
31:08
You know, I was just thinking that scenario that my first
31:11
reaction was disable the account and make the person reset their
31:17
credentials. The the marketing side of me
31:21
said no, if they know the password, let them in.
31:25
I don't think either answer is necessarily the right answer.
31:28
I think it's the organization has to weigh those pros and cons
31:32
and come up with their approach. So that's a great conversation,
31:37
a lot to think about. One of the things I wanted to
31:40
touch on, Brandon, is, you know, financial services is a big
31:43
focus on compliance. And I think the words compliance
31:48
and security sometimes get intermingled, but I think they
31:52
they're different. I think they often have the same
31:55
goals. So I'm wondering what are your
31:59
perspectives on that when, especially when compliance and
32:04
security compete for the same limited resources?
32:10
Yeah. So I love this conversation.
32:15
It's kind of the intersection not just with compliance, but
32:19
the the risk and the governance pieces to it.
32:21
So compliance are effectively the way that you've written your
32:25
your minimum standards, right, The way that you've gone through
32:29
and whether it's from a regulatory perspective or
32:32
whatever is applicable, you kind of tempered that kind of this is
32:35
going to be your floor. But most organizations really
32:39
struggle with that because depending on kind of the nature
32:42
of the stacking of the compliance requirements to you
32:45
or the acronyms that typically follow, depending on how you're
32:48
governing or if you're a global or multinational organization,
32:52
it gets really, really complicated.
32:54
The purpose of all of this, though, the purpose of these
32:57
compliance frameworks is really to make you understand your
33:00
risk, right? And and to be more aware of the
33:04
risks that you're carrying certainly in the identity space.
33:07
And so, you know, if you get down to maybe a principles based
33:12
approaches, are you aware of how much risk you're carrying?
33:16
Are you thinking about those what if scenarios are you doing
33:19
that threat modeling against the system to then, you know, double
33:23
click on your identity to understand how does your
33:26
strategy apply? Right.
33:28
And so they're very much complementary, but you can
33:31
certainly be compliant, but not it'd be compliant, but not
33:36
secure. Compliance in some cases kind of
33:38
gives you a Gray area of kind of how to how to prove it, how to
33:42
generate evidence or how to, you know, present to a regulator
33:46
depending on if you're attesting or self attesting to something.
33:51
But in the end, you're, you're trying to describe how you
33:55
protect your data, how do you protect your systems?
33:58
And most importantly, how do you prove it.
34:00
And that optionality and that creative liberty is still the
34:06
responsibility of the company. And it should be more risk
34:09
driven, which is a measure of maturity for a security
34:13
organization, than being compliance driven.
34:16
If you're swimming in compliance problems or you're struggling
34:20
with your compliance minimums, it's more than likely because
34:24
you haven't spent enough time really understanding your risk.
34:27
That also enables you to better speak to whether it's your
34:31
executive team, your business leaders, your peers in your
34:36
organization, or certainly the folks that through policy you're
34:40
trying to get them and working with them to get to a better
34:44
state. You also have to describe on
34:46
your journey where you are. The purpose of a risk or any
34:50
type of a road map or program is to say you are here today and
34:55
you are aspiring to be there at some other point in time.
34:58
And then how you measure yourself across the way is
35:01
fundamentally what all these compliance and what these
35:05
regulators are looking for. If you're ignorant to risk or if
35:08
you've willfully said I am aware of the risk and I'm not going to
35:12
do it in a way that it isn't appropriately documented, that's
35:15
where you run into trouble and that's when the negligent work
35:19
starts to come into the other the conversation.
35:23
Yeah. And it feels like certainly an
35:27
insurance when you're speaking to executives of an insurance
35:30
company, they understand risk. And I mean, but so that's your
35:36
background and it really helps you speak about risk, but how
35:42
can people become more able to tell that story of risk?
35:47
How can they really describe taking that risk based approach?
35:54
Learn how to speak about it. Yeah, I, what I love about it is
36:00
not everybody has the, the, the luxury of applying actuarial
36:03
techniques right to your program.
36:07
And when you think about how most Csos are in role today or
36:12
assumed a role, and I think this is, you know, across industry,
36:15
you kind of got there through experience, right?
36:18
You got there through, you know, Hard Knocks, Hard Knocks with
36:22
experience and really learning and seeing and understanding
36:26
what some of those foundational capabilities are, one of which
36:29
of course is understanding identity, right.
36:31
And so I think the opportunity to go through and really
36:36
organize around, you know, how you start to measure start, how
36:39
you start to quantify risk really depends on the
36:42
methodology or you know, the where you are in your journey,
36:46
right? There are, there are plenty of
36:49
partnerships out there, there plenty of methodologies and
36:52
frameworks that help you go through and understand, how do I
36:56
start to understand and quantify your risk?
36:58
But you have to spend the time to understand how are you
37:02
grouping your risks and how are you grouping your assets?
37:06
And then what are your, what are your loss outcomes, right?
37:11
If you are you defending against a data exfiltration or is your
37:15
system providing you know some sort of life support for a
37:20
particular industry or a particular customer base?
37:23
Are you going to be dinged if you have a service disruption
37:26
and you're not able to fund a loan or you're not able to
37:30
service a customer, so you break a customer SLA, Are you not
37:34
going to be able to pay out a claim?
37:36
In which case you're suffering all sorts of contractual issues,
37:40
especially when you think about, you know, everything that's
37:43
going on through Florida right now, right?
37:45
There are businesses where they don't get things built.
37:48
If money doesn't flow, homes don't get built, businesses
37:52
don't get built, and then you start to see a further decay,
37:56
right? And so I think it it opens the
37:59
door and it provides the opportunity to kind of look at
38:02
all of those business cases. What are you solving for And
38:05
then what is the framework and what is the methodology that
38:08
best applies to my business? The more successful programs are
38:13
out there looking at how do I start to quantify my risk and
38:17
then how do I apply that in a what if scenario versus taking a
38:21
compliance based approach and being subject to the ever
38:24
changing landscape. Some people are going to think I
38:28
saved the best topic for last. And Speaking of risk, the
38:32
perfect time to bring it up. So I want to talk about cyber
38:36
insurance. And you've come from an
38:39
interesting or somewhat unique background where you've been a
38:44
customer of cyber insurance, but you've also worked for a broker
38:49
of cyber insurance. And I wanted to know, I mean,
38:53
obviously this is something you're a mile deep, but really
38:56
what I want to know is from the identity practitioner
38:59
perspective, what do identity practitioners need to know about
39:04
cyber insurance? Yeah.
39:07
So it will appear it, it just to kind of clarify my capacity,
39:12
right. I've had the benefit of seeing
39:15
the changing cyber insurance landscape, both as somebody who
39:19
has purchased cyber insurance over the last 15 plus years, or
39:24
even having the luxury and the privilege of helping look at and
39:28
see the evolution of cyber risk products.
39:30
And so I've been able to sit on both sides of the desk and, and
39:33
come to see that evolve over time, which is fascinating.
39:36
And I think, you know, if you've ever experienced the, the
39:39
questionnaires that are like, OK, how much MFA do you have?
39:42
And do you have MFA on all systems, then that doesn't
39:46
really help anybody, right? And So what you've seen over the
39:50
course of time is the opportunity and you, you've seen
39:53
the losses and the, and the benefit of the carriers and even
39:56
the brokers is that they have access to the loss data, They
40:00
have access to the claims data, which over the time indicates
40:05
what took place, what happened, what went wrong potentially over
40:09
the last 12 months or the last renewal cycle or otherwise.
40:13
And so you know from that perspective, when you start to
40:15
see more poignant questions or you start to.
40:19
Or they start to look for publicly available sources and
40:22
there's plenty of incidents and breaches that are publicly
40:26
available and you start to see the root cause.
40:28
Well, there is a common theme, right?
40:31
There is a common theme. So you see more, you see more
40:34
pointy questions that are related to identity and there is
40:39
the ransomware scare. There are more poignant
40:42
questions and the opportunity to start to demonstrate maturity
40:47
not just in like the tools that you purchase, but in the overall
40:50
program. And So what good potentially
40:53
looks like is going back to before you transfer that risk
40:58
through a cyber insurance policy, how how mature are you
41:03
or where are you in your journey?
41:05
Why are you doing the things that you're doing?
41:08
What is your progress? You know, they will ask
41:10
questions about, you know, your privileged accounts.
41:13
Do you have a privileged account management solution?
41:16
What are you doing for this and things like that.
41:19
However, what good potentially looks like is do you have the
41:23
data that helps you understand how to potentially figure that
41:27
right or how to how do you appropriately apply it, how to
41:32
appropriately prevent a loss from happening?
41:34
And I think that's a gap in the industry.
41:37
When you think about what you're trading off in terms of the
41:40
costs associated with the cyber event, it's mostly legal fees,
41:45
right? Legal fees, class action
41:47
lawsuits that are dealing with the communications, dealing with
41:50
levies, fines and penalties. And so there's still a gap.
41:53
You don't get when you file a claim additional budget from
41:58
that claim to go and invest more in the identity program if that
42:03
was determined to be the root cause.
42:05
And so you see more and more of that.
42:07
Most brokers, most of the relationships certainly that
42:10
businesses interact with will sit alongside, if you're working
42:14
with the right broker and talk about these controls and they'll
42:17
help prepare you for this and they'll talk about that.
42:20
It'll be in their top eight or their top six, their top 12.
42:23
But it's certainly in the calculus cause on the back end
42:26
where the folks that are developing these products and
42:29
are able to understand and apply a weighting to a particular
42:33
control of technology or processes.
42:36
It's in the top three, most certainly right in the calculus,
42:40
where if you do not have the right maturity in your program,
42:45
you may run the risk of being uninsurable.
42:49
That can come in many forms. They can be coming in those
42:51
derelict assets that we had talked about earlier, those old
42:54
things that may be predated modern identity access
42:58
management technologies. It can come in the form of, you
43:01
know, this concept of resiliency.
43:03
So if you suffer a ransomware event, how do you go through and
43:07
restore the identity and access management systems that power,
43:11
you know, your workforce or allow access to your customers
43:15
so that it's not a service disruption over time.
43:17
So it absolutely blends in. And I would say especially going
43:20
into this next renewal cycle, you're going to see a very, very
43:25
Cognet level of questioning or a very, very refined level of
43:28
questioning on 3rd party management, right?
43:31
How do you know who you're working with is who you intend
43:35
to work with? You're going to start to see an
43:38
absolute affinity to that and a heck of a lot of questioning
43:42
related to 3rd party risk management, which is how do you
43:45
manage those non workforce but critical partners, contractors,
43:51
suppliers that get access to your environment to do the
43:54
things that need to be done in your to deliver your business.
43:59
I think you made a really cool point there and I just want to
44:02
underline or under score it, which was the whole idea of
44:06
cyber insurance is transferring the risk from your organization
44:10
to your insurer. And that really drives a lot of
44:16
what you're saying, which is that the insurer wants to
44:20
understand how are you going to deal with or what, what are the
44:24
controls that you have in place that would help prevent a cyber
44:28
attack or, you know, ransomware type event?
44:33
And then how would you be able to recover from a ransomware
44:36
type event? One of the things, Brendan, that
44:38
I want to pull out of this conversation is thinking as the
44:42
identity practitioner, what are some things that I can be doing
44:46
to help lower my cyber insurance costs or maybe may have been
44:52
rejected for a policy in the past.
44:55
What are the things that I could be doing now to better my
44:59
position? I think one of the strongest
45:02
relationships you need to form to better your position is
45:05
working with the CFO organization, right.
45:08
And so if you have an enterprise risk management function and
45:12
cybersecurity's top of mind, then you have to make sure that
45:16
it stays relevant or that you're treating it as a top of my issue
45:20
for the company. And the way you do that is by
45:23
working with the CFO organization because they're the
45:26
ones that are typically directly buying the cyber insurance
45:29
policy. They're buying it as an umbrella
45:32
with, you know, maybe protecting all of their, protecting all of
45:36
their properties that they have, or maybe they're buying
45:39
directors and officers insurance, you know, maybe
45:42
they're buying, you know, workers compensation insurance,
45:45
but that's typically bundled together that way.
45:47
And so when you think about it and you worry or, or you start
45:50
to work with the CFO organization, you understand the
45:53
business and how this flows because what you're basically
45:56
doing with the money that you're delegated with your budget is
46:00
you're offsetting whatever that cyber insurance policy is.
46:04
So let's pretend that that cyber insurance policy is worth $10
46:08
arbitrarily and you're given 3030 and you're given $3 to work
46:13
with. You have to help tell the story
46:16
for how your $3 is offsetting that $10 policy through all of
46:21
the things you're doing and in the context of what we're
46:24
describing your identity program.
46:26
And so what's challenging, and I think another opportunity for
46:29
this the cyber insurance industry or just for the the
46:33
industry as well is how do you meaningfully pay down that risk,
46:37
right? You have to apply effectively
46:39
awaiting, you have to manage your risk.
46:41
But it ultimately comes in the way that you're allocating your
46:45
budget, the progress that you're making, that road map, but then
46:48
translating it into the dollars and cents that the CFO
46:52
organizations ultimately look at when they're balancing the
46:56
budgets, right? They're looking at the money
46:58
that's coming in, the assets that they carry and the money
47:01
that's going out. And so I think that's one of the
47:04
strongest relationships that you need to form.
47:07
They're the ones that are going to look at the overall portfolio
47:10
and they're going to go through and start to say, OK, I'm going
47:12
to transfer this risk versus, you know, directly fund.
47:17
And most Csos aren't as formidable in that realm.
47:22
And it's an opportunity for Ccos to be Better Business partners,
47:26
to understand how money works, especially in an organization.
47:31
And in IT, if you do that, then you start to understand and have
47:34
more informed conversations with the insurers, with the brokers.
47:40
And it's, it's a, it's a wild, it's a, it's a very rewarding
47:44
journey, but not one that I've heard taken as often.
47:49
It's really great information what you, you know and I don't
47:52
think we've covered that on the podcast in the in the past,
47:55
which is that $3 investment to save the $10.
48:00
I really love that kind of thinking, which is what can I do
48:04
or where can I make investments that's going to yield outside
48:09
savings? Brandon, are there certain areas
48:12
where if you make the investments you're, you're going
48:15
to get more of a return in terms of or is it something that just
48:19
depends on the organization and where your weaknesses lie?
48:24
I think it comes in the form of how risk aware you are and those
48:28
what if scenarios, right? And it it's, it's hard to give
48:31
kind of A1 size fits all, but the tools to go through and help
48:35
you apply framework, apply methodology, apply weighting.
48:39
Like again, do you have a three dollar problem related to
48:42
identity or do you have a $7.00 problem in, in that context of
48:45
offsetting $10? Well, how do you determine that?
48:49
Well, you know, it comes back to that resiliency conversation.
48:52
If those systems go down or if those systems become
48:56
uninterrupted for a period of time, do you know how much
49:00
that's going to hurt you, right, if you're not able to deliver on
49:05
a promise or a service or product?
49:08
And so I think that's where the risk conversation comes in.
49:13
And so tangibly, right, anything you could do to help build
49:17
trust, but again, prevent the idea of a password from being
49:21
stolen and used in a way that's unfettered is, you know,
49:25
certainly the way to go, right? I think most organizations or
49:28
most identity programs are leaning towards, you know, the
49:31
password less types of technologies.
49:34
It's starting to remove that from the equation.
49:36
There's nothing to steal, right? Then credential stuffing becomes
49:40
or or becomes effectively negated.
49:43
And so then, well, how do you do that?
49:45
But you have to be further along on your journey to actually you
49:48
establish a level of trust without that, you know, long
49:53
standing process, right or process or stack.
49:59
And it, when you think about it, it the, the principle of least
50:03
privilege, for example, has been around since like the 1970s, but
50:08
we're still struggling with applying that into the
50:11
organization because you're still seeing that be more and
50:14
more rampant where we're not taking the opportunity to return
50:18
back to quality. So it's not like it, it's not
50:21
the, it's not the I'm gonna go buy it or I'm gonna go transform
50:24
it. It's just getting down to the
50:27
basics, being aware of the risks that you carry and then focus on
50:33
one of the three things. Managing your assets, managing
50:36
change to those assets, and certainly managing identity.
50:39
That's your Holy Trinity when it comes to the basics of what a
50:43
security program is. It is intending to have
50:47
oversight, monitor and protect. That's really great.
50:53
Last question on this topic. So who's cyber insurance for?
50:57
Is it small to bin sized businesses?
50:59
Is it large multinational enterprises and are they held to
51:04
different standards or is it pretty much every organization
51:09
kind of qualifies for or or should be interested in cyber
51:13
insurance? That's a great question.
51:17
If you're in the regulated space, it's, it's now a
51:20
requirement from a fiduciary and statutory perspective, right?
51:24
You want to protect shareholder value.
51:27
And the idea of what you're offsetting from a cyber
51:30
insurance perspective is that if you suffer a service disruption
51:35
related to a nefarious actor or a cyber actor, for example, or
51:40
if there is a software disruption that it leads to a
51:47
service disruption that qualifies for you to be
51:51
recompensated based on what the policy is offering.
51:54
And so regulated industry, the fact that regardless of size in
51:59
many cases are typically, there's typically a, a size of
52:03
assets that helps describe, OK, when you start to, to carry
52:08
that. Now that's if you take kind of a
52:10
compliance or regulatory lens to it.
52:12
When you start to think about it, it's more about, you know,
52:16
what are you looking to offset? What are you looking to protect?
52:19
Do you have an idea of like what your likelihood is based on
52:23
what's going on in the world and the average size of the claim?
52:27
And then can you suffer? Can you, can you go through and
52:31
pay that bill if it happens to you, right?
52:34
And so in many cases, and if you talk to, of course, you know,
52:38
the insurance industry, they're going to want you to buy more,
52:42
right? They're going to want you to buy
52:43
more insurance, of course, right?
52:44
There's, there's a, there's a absolute interest in, in, in
52:50
that. However, the reality is you only
52:54
get to that point in an informed way if you're better
52:58
understanding the risk that you're currently carrying,
53:00
right? And so, you know, international
53:04
publicly traded, most certainly there's regulatory requirements.
53:08
But then even if you are that around the corner law firm, for
53:13
example, right, there are cases or an educational institution,
53:18
you know, there are cases where companies that have been
53:21
financially distressed or on their last gasp have not
53:25
returned back to business because of a cyber event, right?
53:29
They weren't able to restore. All the intellectual property
53:32
was ransomed and they weren't able to restore back in time.
53:36
And so, you know, that's the unfortunate truth of kind of
53:39
where we sit. The insurance sure would have
53:42
been secondary, but you know, the basics weren't followed.
53:46
The whole purpose and the basics for insurance or the the whole
53:50
risk world is there is the bang that occurs, right?
53:55
There's the pre bang work that you're doing to prevent that
53:58
from happening, that there's everything that happens after
54:01
the bang that comes in the form of the insurance policy.
54:05
So the better you can get upstream and the better
54:07
preventative things you could do it you're you're, you're not
54:12
wanting to trigger the cyber insurance clauses as a strategy.
54:16
You want that as a last resort. That's the purpose.
54:20
So many good Nuggets there. Brendan.
54:22
I really appreciate all the time you spent with us today.
54:25
I think this is going to be a fantastic episode.
54:29
Before I let you go, we like to finish every episode on a
54:33
lighter note, something not IT and information security
54:37
related. So you've been a major voice for
54:41
San Antonio, TX, your hometown, and I was wondering what is
54:46
something people should know, maybe don't know about San
54:50
Antonio. And we all know about the famous
54:53
River Walk, so it's got to be something else.
54:56
I love that question and thank you for asking that.
54:59
And yes, I'm a, I'm a big proponent of San Antonio.
55:02
Obviously, it's been home for the last 20 years.
55:05
And I think what's interesting about it is that we're not just
55:07
known for the river walk in the Alamo, but but there's, there's
55:11
a vibrant technology community here and there's also a vibrant
55:16
cybersecurity community that's here as well, you know, between
55:20
the 7th largest city in the nation, but it doesn't feel that
55:24
way. There's tremendous
55:25
infrastructure, but there's also over 3000 cybersecurity
55:29
professionals in our backyard. And so when we think about that
55:33
opportunity between the military, the NSA and private
55:36
industry and public industry, there's a tremendous wealth of
55:39
knowledge that exists here. And So what we see is the
55:42
opportunity, you know, to extend the national reach, right, to
55:47
provide subject matter expertise or you know, the operational
55:51
experience certainly in cyber at at a national level.
55:55
And so I think when we think about kind of the relationship
55:58
between San Antonio and other cities inside of Texas, it is
56:02
something that I think is a Greenfield.
56:04
It's really a fascinating opportunity to to grow and tap
56:08
into the wisdom of crowds that are here.
56:10
And So what I'd love people to know about is that, you know,
56:13
there's over 450 start-ups here, a tremendous amount related into
56:17
the technology space and in the cyberspace, You know, 3000
56:21
cybersecurity professionals with an amazing pipeline of academia
56:27
and, and transitioning military that are ending, you know, their
56:31
career and looking to go into private industry or help help
56:35
fight the good fight. And so, you know, the
56:38
opportunity to develop those partnerships or prolong those
56:41
partnerships is certainly available.
56:43
And that's something I'm really passionate about.
56:45
I dedicate my time in academia. I serve as an advisor to various
56:49
universities here on programming and curriculum related to
56:53
cybersecurity, artificial intelligence, and data science.
56:57
And, you know, I think there's a great opportunity.
57:00
And I also, you know, advise a number of startups and companies
57:04
that are certainly looking to solve these hard problems and
57:08
need the workforce. And so that's something I'm very
57:10
passionate about. Brenda, your great voice for the
57:14
city, great voice for the community, and we'll put your
57:20
your LinkedIn link and the show notes.
57:23
So if people want to reach out to you, I think that's probably
57:26
the best way to do it. For now.
57:29
I'm going to say thank you, Brandon.
57:31
I'm going to close this out by reminding everyone we are on the
57:35
web at idcpodcast.com. We're on Twitter or X at IDAC
57:42
Podcast. Of course, you get our YouTube
57:44
channel by going to idacpodcast.tv and we're on
57:48
Macedon. I think we're Soul Mastodon,
57:51
which is at IDAC Podcast at infosec. dot exchange and
57:56
connect with Jeff, myself and Brandon on LinkedIn and
58:01
subscribe when new episodes come out.
58:03
We'd love to make sure that, you know, every time we have a new
58:08
episode. So I'm going to just say thanks
58:10
everyone and talk to you on the next one.
58:15
You've been listening to Identity at the Center.
58:18
We hope you've enjoyed the show. Make sure to like, rate and
58:22
review, and we'll be back soon. But in the meantime, hit the
58:26
website at identity@thecenter.com.
58:30
See you next time on Identity at the Center.